medium5.3
CVE-2026-13692
The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing unauthent…
Impact
The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders.
Affected products
| Product | Affected versions |
|---|---|
| PayU CommercePro Plugin WordPress Plugin | before 3.9.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.